.TH ddos 1

.SH NAME
ddos \- script to mitigate small denial of service attacks.

.SH SYNOPSIS
.B ddos
[OPTION]
.br
.B ddos
(-k|--kill) <NUMBER_OF_CONNECTIONS>

.SH DESCRIPTION
.PP
(D)DoS Deflate is a lightweight bash shell script designed to assist in
the process of blocking a denial of service attack. It utilizes the
command below to create a list of IP addresses connected to the server,
along with their total number of connections. It is one of the simplest
and easiest to install solutions at the software level.

.B netstat
-ntu |
.B awk
\'{print $5}\' |
.B cut
-d: -f1 |
.B sort
|
.B uniq
-c |
.B sort
-nr

.PP
IP addresses with over a pre-configured number of connections are
automatically blocked in the server's firewall, which can be direct
iptables or Advanced Policy Firewall (APF). (We highly recommend that
you use APF on your server in general, but deflate will work without it.)

.SH OPTIONS

.TP
\fB\-h\fR, \fB\-\-help\fR
display the script options
.TP
\fB\-c\fR, \fB\-\-cron\fR
update or create cron job to run this script regularly
.TP
\fB\-i\fR, \fB\-\-ignore\-list\fR
dsiplay a list of currently whitelisted ip addresses
.TP
\fB\-b\fR, \fB\-\-bans\-list\fR
dsiplay a list of currently banned ip addresses
.TP
\fB\-d\fR, \fB\-\-start\fR
initialize a daemon to monitor connections
.TP
\fB\-s\fR, \fB\-\-stop\fR
stop the daemon
.TP
\fB\-t\fR, \fB\-\-status\fR
display the daemon status and pid if running
.TP
\fB\-v\fR, \fB\-\-view\fR
display active connections to the server
.TP
\fB\-k\fR, \fB\-\-kill\fR <NUMBER_OF_CONNECTIONS>
block ip's making \fINUMBER_OF_CONNECTIONS\fR or more

.SH WHITELISTING

.PP
It is possible to whitelist IP addresses by adding a
.B new-line
separated list of ip's to /etc/ddos/ignore.ip.list

.PP
It is also possible to whitelist hostnames by adding a
.B new-line
separated list of hosts to /etc/ddos/ignore.host.list

.SH SETTINGS
You can modify the script settings by editing /etc/ddos/ddos.conf

.TP
.B FREQ = <number>
Frequency in minutes for running the script. Every time this setting is
changed, run the script with --cron option so that the new frequency
takes effect. (Default: 1)

.TP
.B DAEMON_FREQ = <number>
Frequency in seconds to monitor connections when running the script
in daemon mode. (Default: 5)

.TP
.B NO_OF_CONNECTIONS = <number>
How many connections define a bad IP? Indicate that below. (Default: 150)

.TP
.B FIREWALL = '<value>'
The firewall to use for blocking/unblocking, valid values are:
auto, apf, csf and iptables. (Default: "auto")

.TP
.B EMAIL_TO = '<email>'
An email is sent to the following address when an IP is banned.
Leaving this value empty would suppress sending of mails. (Default: root)

.TP
.B BAN_PERIOD = <number>
Number of seconds the banned ip should remain in blacklist. (Default: 600)

.TP
.B CONN_STATES = '<valid netstat states>'
Connection states separated by pipe operator to block. See:
.B netstat(1).
(Default: "ESTABLISHED|SYN_SENT|SYN_RECV|FIN_WAIT1|FIN_WAIT2|TIME_WAIT|CLOSE_WAIT|LAST_ACK|CLOSING")

.SH FILES
.B /usr/local/ddos/LICENSE
.br
.B /usr/local/ddos/ddos.sh
.br
.B /usr/local/sbin/ddos
.br
.B /etc/ddos/ddos.conf
.br
.B /etc/ddos/ignore.ip.list
.br
.B /etc/ddos/ignore.host.list

.SH AUTHOR
Zaf <zaf@vsnl.com> (Copyright (C) 2005)

.SH CONTRIBUTORS
Jefferson González <jgmdev@gmail.com> (Fixes and improvements)
